IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Currently Amended) A method for identifying network traffic, comprising: 

converting traffic data into a wave vector; 

comparing the wave vector with a wave template; 

determining whether the wave vector is substantially similar to the wave 

template; 

wherein the wave vector comprises numerical representations of the traffic 
data obtained bv applving a transformation to a data sequence in the traffic data . 

2. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises performing a transformation on the 
traffic data. 

3. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises performing a transformation on the 
traffic data and zero-padding the traffic data. 

4. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a plurality of 
values. 

5. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a plurality of 
American Standard Code for Information Literchange (ASCII) codes. 

6. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
comparing the wave vector with a wave template comprises determining a difference between 
the wave vector and the wave template and computing a score based on the difference. 
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7. (Original) A method for identifying network traffic as recited in Claim 1 , wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
performing a Fourier Transform. 

8. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining whether the comparison meets a predetermined criteria. 

9. (Original) A method for identifying network traffic as recited in Claim 1 , wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining a score based on the comparison. 

10. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining a score based on the comparison and determining whether the score meets a 
threshold. 

1 1 . (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
wave template is a first wave template and the method further comprises determining whether 
the wave vector is substantially similar to a second wave template. 

12. (Currently amended) A method for identifying network traffic as recited in Claim [[1]] 
ii, wherein the wav e templat e is a first wav e templat e and the m e thod further determining 
whether the wave vector is substantiallv similar to a second wave template comprises: 

computing a first score based on the comparison of the wave vector with 
the first wave template; 

comparing the wave vector with [[a]] the second wave template; 

computing a second score based on the comparison of the wave vector 
with the second wave template; and 

comparing the first score and the second score. 

13. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
traffic data includes information extracted fi-om a data packet. 

14. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
traffic data includes information extracted from a plurality of data packets. 

15. (Currently amended) A method for identifying network traffic as recited in Claim 1, in 
the event that the wave vector is substantially similar to the wave template, further comprising 
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determining a prop e rty that a protocol associated with the wave template also is associated with 
the traffic data. 

16. (Currently amended) A method for identifying network traffic as recited in Claim [[1]] 
15 , in tho ovont that tho wave v e ctor is substantially similar to th e wave templat e , further 
comprising det e rmining a prop e rty asGOoiat e d with the traffic data and returning an identifier 
indicating the property protocol . 

17. (Canceled) 

1 8. (Original) A method for identifying network traffic as recited in Claim 1 , in the event that 
the wave vector is substantially similar to the wave template, fiirther comprising assigning a 
score to a match. 

19. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
wave template is created by: 

collecting sample traffic; 

transforming the sample traffic to a sample wave vector; and 
performing a computation on the sample wave vector. 

20. (Canceled) 

2 1 . (Currently amended) A system for identifying network traffic, comprising: 

a processor configured to convert traffic data into a wave vector; compare 
the wave vector with a wave template; and determine whether the wave vector is 
substantially similar to the wave template; and 

a memory coupled with the processor, wherein the memory is configured 
to provide the processor with instructions; 

wherein the wave vector comprises numerical representations of the traffic 
data obtained bv applving a transformation to a data sequence in the traffic data . 

22. (Currently amended) A computer program product for identifying network traffic, the 
computer program product being embodied in a computer readable medium and comprising 
computer instructions for: 

converting traffic data into a wave vector; 

comparing the wave vector with a wave template; 

determining whether the wave vector is substantially similar to the wave 

template; 
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wherein the wave vector comprises numerical representations of the traffic 
data obtained bv applying a transformation to a data sequence in the traffic data . 
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